For multi-vhost boxes I pin one certificate name per server_name and keep renewals on a timer with --deploy-hook that runs nginx -t && systemctl reload nginx. Avoid overlapping renew jobs.